{"id":273467,"date":"2020-10-30T00:14:12","date_gmt":"2020-10-30T04:14:12","guid":{"rendered":"https:\/\/canadianinquirer.net\/v1\/?p=273467"},"modified":"2020-10-30T07:03:05","modified_gmt":"2020-10-30T11:03:05","slug":"ransomware-can-interfere-with-elections-and-fuel-disinformation-basic-cybersecurity-precautions-are-key-to-minimizing-the-damage","status":"publish","type":"post","link":"https:\/\/canadianinquirer.net\/v1\/2020\/10\/30\/ransomware-can-interfere-with-elections-and-fuel-disinformation-basic-cybersecurity-precautions-are-key-to-minimizing-the-damage\/","title":{"rendered":"Ransomware can interfere with elections and fuel disinformation \u2013 basic cybersecurity precautions are key to minimizing the damage"},"content":{"rendered":"
\"\"<\/a>
Ransomware attacks frequently begin through email as a typical phishing message purporting to be from someone the potential victim trusts, such as a co-worker or friend. (Pexels photo)<\/figcaption><\/figure>\n

Government computer systems in Hall County, Georgia, including a voter signature database, were hit by a ransomware attack<\/a> earlier this fall in the first known ransomware attack on election infrastructure during the 2020 presidential election. Thankfully, county officials reported that the voting process for its citizens was not disrupted.<\/p>\n

The attack follows on the heels of a ransomware attack last month on eResearchTechnology<\/a>, a company that provides software used in clinical trials, including trials for COVID-19 tests, treatments and vaccines. Less than a week after the attack in Georgia was revealed, the FBI warned<\/a> that cyber criminals have unleashed a wave of ransomware attacks targeting hospital information systems.<\/p>\n

Attacks like these underscore the challenges that cybersecurity experts face daily \u2013 and which loom over the upcoming election. As a cybersecurity professional and researcher<\/a>, I can attest that there is no silver bullet for defeating cyber threats like ransomware. Rather, defending against them comes down to the actions of thousands of IT staff and millions of computer users in organizations large and small across the country by embracing and applying the basic good computing practices and IT procedures that have been promoted for years.<\/p>\n

What is ransomware?<\/h2>\n

Ransomware is a form of malicious software, or malware, that typically encrypts a victim\u2019s computer files, holds the files hostage and then demands a payment to send the decryption key that unlocks the files. Individual ransomware payments usually range from a few hundred to a few thousand dollars, with the expectation that a relatively low dollar amount will motivate the victim to quickly pay the attacker to end the incident.<\/p>\n

Ransomware attacks frequently begin through email as a typical phishing<\/a> message purporting to be from someone the potential victim trusts, such as a co-worker or friend. However, emerging types of ransomware exploit existing or recently discovered security vulnerabilities \u2013 in other words, they hack in \u2013 to gain system access<\/a> without requiring any user interaction at all.<\/p>\n

Once a computer system is compromised, there are many things a ransomware attack can do. But the most common outcome is encrypting a user\u2019s data to hold it for a ransom payment. In other cases, ransomware encrypts a victim\u2019s data and the ransomware\u2019s creator threatens to release personal or sensitive information onto the internet unless the ransom is paid.<\/p>\n

\"Computer
A typical ransomware attack seizes control of a victim\u2019s computer files and holds them for ransom.<\/span>
\nSo5146\/Wikimedia<\/a>, CC BY-SA<\/a><\/span><\/figcaption><\/figure>\n

While ransomware attacks can affect any internet user or organization, attackers tend to target entities known for having less-robust cybersecurity defenses, including hospitals, health systems and state or local government computers<\/a>. But health care remains an enticing ransomware target: In 2019, 759 health care providers<\/a> in the U.S. were hit. Overall, ransomware attacks cost users and companies over US$7 billion<\/a> in 2019 as a result of either ransoms paid or through costs incurred in recovering from attacks.<\/p>\n

Ransomware\u2019s toll<\/h2>\n

The first high-profile ransomware incident was launched by North Korea in 2017. Using malware called \u201cWannacry<\/a>,\u201d the attackers brought the British National Health Service to a paralyzing halt. Hospitals lost access to their computer systems and routine and emergency care was disrupted. But that was a preview of things to come: In 2020, a patient in Germany died<\/a> after being diverted to another hospital due to a ransomware incident.<\/p>\n

In 2020, during the COVID-19 pandemic, a ransomware attack crippled over 250 medical facilities<\/a> run by American-based Universal Health Services. At eResearchTechnology, staff conducting COVID-19 clinical trials were locked out of their data<\/a> and unable to conduct business for nearly two weeks.<\/p>\n

And it\u2019s not just health care organizations. The city of Atlanta was crippled<\/a> by ransomware in 2018. Baltimore was similarly paralyzed<\/a> in 2019. In both cases, city services \u2013 from tax collection and business licensing to real estate transactions \u2013 were unavailable to citizens. Numerous smaller cities around the world also have been affected by ransomware attacks.<\/p>\n

However, even organizations with good IT policies and procedures find it extremely costly<\/a> to investigate and recover from ransomware attacks, whether or not they pay the ransom. For example, an organization\u2019s routine data backup can also inadvertently include ransomware code. This means victims need to ensure they are not restoring the ransomware infection<\/a> when they reconstruct their systems after an attack. Depending on the victim\u2019s backup procedures, locating a ransomware-free backup can be a very time-consuming process.<\/p>\n

Ransomware and election 2020<\/h2>\n

The 2016 elections underscored the importance of ensuring the security and integrity of information related to government operations, including elections. Unfortunately, for many state and local governments, ransomware concerns are just another in a long line of issues<\/a> that cybersecurity teams must contend with during periods of limited budgets and staffing.<\/p>\n

Much has already been written<\/a> about the vulnerable and fragile state of America\u2019s election systems, ranging from obsolete operating systems installed on voting machines to insecure networks and systems that exchange and store vote tabulations, to ensuring the protection of voter registration databases.<\/p>\n

Making this situation more challenging is that many local governments don\u2019t know what\u2019s happening on their networks. A nationwide survey<\/a> conducted by University of Maryland, Baltimore County researchers in 2016 reported that nearly 30% of local government officials would not know if a cyberattack was affecting them. This lack of awareness means an attack could be well underway and causing havoc before security teams realize it \u2013 let alone respond.<\/p>\n

Despite a growing awareness of the threat, ransomware has the potential to adversely affect the 2020 election. Unfortunately, if state and local election offices haven\u2019t implemented strong cybersecurity protections by now, it\u2019s probably too late to do anything meaningful given that voting is well underway. So it\u2019s no surprise that election offices across America are considering potential nightmare scenarios<\/a> that include cyberattacks that might disrupt election activities.<\/p>\n

Fuel for disinformation<\/h2>\n

Elections are based on trust \u2013 trust in the voting mechanisms and procedures, trust in the voting data and trust in the overall electoral process. But trust in all these items is under active attack<\/a> by adversaries both at home<\/a> and from abroad<\/a> using a variety of influence and disinformation techniques<\/a> that have become more refined<\/a> since 2016.<\/p>\n

Thankfully, ransomware attacks are unlikely to cripple the entire U.S. election given the decentralized nature<\/a> of voting jurisdictions and systems. However, even a few successful attacks could contribute to disinformation campaigns<\/a> that erode confidence in the outcome of the election.<\/p>\n

[Expertise in your inbox. Sign up for The Conversation\u2019s newsletter and get expert takes on today\u2019s news, every day.<\/a><\/em>]<\/p>\n

How to lower the risk<\/h2>\n

At this point, since the election is already happening, state and local governments should increase the monitoring of their computer systems and implement even more stringent security controls on any devices or computers that might touch election-related networks in any way. Sharing real-time information about threats and working with the DHS, FBI and Office of the Director of National Intelligence election security teams, along with other states\u2019 election offices, also will help keep election officials informed. Additionally, major technology vendors<\/a> and the U.S. military<\/a> are taking active steps to disrupt cybersecurity threats, including ransomware, that may target the electoral process.<\/p>\n

As with most cybersecurity problems, the ransomware threat can be minimized by implementing common-sense best practices \u2013 many of which have been recommended for decades<\/a> but often are not followed. These include keeping systems up to date, ensuring security software is installed and current, monitoring network activities and implementing appropriate IT policies and procedures to include resilient backup practices. For individual users, thinking before clicking an email link \u2013 even from people you know \u2013 is excellent self-defense to make many ransomware or phishing attacks less likely to succeed.<\/p>\n

None of these practices is specific to the ransomware threat or election security. But for this and other cyber threats, the best thing to do is continuing to implement and enforce those common-sense, decades-old best practices of information protection that can help guard against the ever-widening range of cyberthreats \u2013 including ransomware.\"The<\/p>\n

Richard Forno<\/a>, Senior Lecturer, Cybersecurity & internet researcher, University of Maryland, Baltimore County<\/a><\/em><\/p>\n

This article is republished from The Conversation<\/a> under a Creative Commons license. Read the original article<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Government computer systems in Hall County, Georgia, including a voter signature database, were hit by a ransomware attack earlier this …<\/p>\n","protected":false},"author":44,"featured_media":273469,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54365,5],"tags":[],"class_list":["post-273467","post","type-post","status-publish","format-standard","has-post-thumbnail","category-instagram","category-technology","mauthors-richard-forno-university-of-maryland-baltimore-county","mauthors-the-conversation"],"_links":{"self":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts\/273467","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/comments?post=273467"}],"version-history":[{"count":1,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts\/273467\/revisions"}],"predecessor-version":[{"id":273470,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts\/273467\/revisions\/273470"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/media\/273469"}],"wp:attachment":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/media?parent=273467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/categories?post=273467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/tags?post=273467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}